A method and system for detecting illegal Ethereum accounts based on time-series graph neural network

Abstract

The present invention proposes an Ethereum illegal account detection method and system based on a time-series graph neural network, which relates to the technical field of network security. The method comprises forming a label data set with transaction data of illegal label accounts and normal label accounts, constructing an Ethereum illegal account detection model including a time-series subgraph generation module, a representation update module, an association prediction module and a classification output module. The label data set is used to train the Ethereum illegal account detection model, and the account to be detected is input into the trained Ethereum illegal account detection model to obtain a detection result of the account to be detected. While learning the dynamic representation of the Ethereum account, the method takes into account the correlation between the target account's transaction and subsequent transactions in the account representation learning, thereby further optimizing the effective identification of illegal accounts on Ethereum.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and more specifically, to a method and system for detecting illegal Ethereum accounts based on a time-series graph neural network. Background Art

[0002] Blockchain technology is currently attracting widespread attention and is hailed as one of the key foundational information technologies that will trigger a new round of technological revolution and industrial transformation. Ethereum, a decentralized cryptocurrency platform with smart contracts, has also garnered increasing attention. However, due to its anonymity, various fraudulent activities have emerged on Ethereum, including phishing scams, Ponzi schemes, honeypot scams, and ICO scams.

[0003] In recent years, the detection of illegal Ethereum accounts has primarily been achieved through graph representation learning. Existing techniques typically construct a transaction network based on Ethereum transaction data. Specifically, for a transaction, the accounts of both parties are typically treated as nodes, and edges are constructed between the two nodes to represent the transaction. After constructing the transaction network through multiple transactions, graph representation learning methods, such as random walks and graph neural networks, are used to learn node representations. These representations are then input into downstream classifiers to classify and identify the nodes. Based on the classification results, it is determined whether the corresponding account is an illegal account. However, this type of detection method still has shortcomings. When learning node representations through graph representation methods, the constructed transaction network is usually fixed, and the learned node representations are also fixed. However, transactions occur over time, and account status changes as transactions occur.

[0004] Prior art discloses a deep learning-based method for detecting Ethereum phishing accounts. The method features the following: The Ethereum transaction network is modeled as a time-series weighted directed graph, combining transaction time and weight features. This effectively captures the more comprehensive dynamic nature of the transaction network. The skip-gram model is then used to derive graph embedding feature vectors for each account node in the time-series weighted directed graph. Finally, these embedding feature vectors are input into a classifier to obtain phishing account classification results. However, while this approach accounts for the dynamic nature of accounts, it fails to consider transactions occurring locally within a period of time after the subgraph is constructed. Specifically, this approach considers the correlation between transactions occurring in the target account's local neighborhood after a key transaction of the target account occurs and the transaction itself. Summary of the Invention

[0005] To solve the current problem, the present invention proposes an Ethereum illegal account detection method and system based on a time-series graph neural network. By constructing an Ethereum illegal account detection model to learn the dynamic representation of Ethereum accounts, and at the same time considering the correlation between the target account's transactions and subsequent transactions in the account representation learning, the effective identification of illegal accounts on Ethereum can be achieved.

[0006] In order to achieve the above technical effects, the technical solutions of the present invention are as follows:

[0007] A method for detecting illegal Ethereum accounts based on a time-series graph neural network, comprising:

[0008] S1. Collect transaction data of illegal and normal labeled accounts to form a labeled dataset;

[0009] S2. Construct an Ethereum illegal account detection model, which includes a time-series subgraph generation module, a representation update module, an association prediction module, and a classification output module; train the Ethereum illegal account detection model using a labeled dataset to obtain a trained Ethereum illegal account detection model;

[0010] S3. Input the account to be detected into the trained Ethereum illegal account detection model to obtain the detection result of the account to be detected.

[0011] This technical solution builds an Ethereum illegal account detection model, taking into account the transactions that occur locally in the target account within a period of time after the subgraph is constructed. That is, the correlation between the transactions of the local neighbors after a key transaction of the target account and this transaction, thereby achieving effective identification of illegal accounts on Ethereum.

[0012] Preferably, the timing subgraph generation module is used to obtain the transaction timing subgraph, and the training process includes:

[0013] A local transaction network will be constructed based on the transaction data in the labeled dataset;

[0014] The connected component where the target account is located is extracted from the local transaction network as the transaction time sequence subgraph.

[0015] Preferably, a local transaction network is constructed based on the transaction data in the label dataset, including the following steps:

[0016] The labeled account in the labeled dataset is used as the target account. The target account is used as the central node, and the other party's account that transacts with the central node is used as the first-order neighbor node. An edge is constructed between the two transaction accounts, and the transaction time and amount are used as edge features.

[0017] The first-order neighbor nodes are used as central nodes in turn. Second-order neighbor nodes are constructed based on the transaction data of the central nodes. Edges between the two transaction accounts are constructed, and the node types are classified into user accounts and contract accounts.

[0018] Repeat the above steps m times to obtain the m-order local transaction network of each tag account, where the m-order local transaction network is a heterogeneous graph.

[0019] Preferably, the connected components where the tag accounts are located are extracted from the local transaction network as the transaction time sequence subgraph. The process includes:

[0020] Filter the time corresponding to the k transactions with the largest transaction amounts, sort the obtained time, and use it as the time point to be intercepted when extracting the transaction time series subgraph;

[0021] In the m-order local transaction network, all edges whose time features are before each time point are retained, that is, transactions occurring before each time point are retained, and k connected components where the target account is located are extracted as the transaction time sequence subgraph.

[0022] Preferably, the representation updating module is used to calculate the sequential subgraph representation corresponding to the transaction sequential subgraph node, and the process includes:

[0023] A graph neural network is used to learn the representations of different types of nodes in each transaction timing subgraph after multiple aggregations of neighbor features. The mean of the representations after all node feature aggregations is calculated as the graph representation. The graph representation is the timing subgraph representation of the corresponding transaction timing subgraph node.

[0024] Preferably, the algorithm of the association prediction module includes:

[0025] Using a deep network model, calculate the correlation factor between subsequent transactions and target accounts;

[0026] Calculate the global correlation factor and superimpose the global correlation factor with the temporal subgraph representation to obtain the updated temporal subgraph representation;

[0027] The updated temporal subgraph representation is processed using a time series model to learn the temporal features of the target account, obtain a series of new graph representations, and take the last graph representation as the final representation of the target account.

[0028] Here, by performing a processing and updating operation on the graph representation, the final representation of the target account is obtained, which can represent the latest global information of the target node.

[0029] Preferably, a deep network model is used to calculate the correlation factor between subsequent transactions and the target account through all transactions in a period of time following each time node; the representations of the corresponding nodes of the two accounts of each transaction obtained by graph neural network learning are spliced ​​as the input of the deep network model to obtain the correlation factor of each transaction; the average value of all correlation factors is calculated to obtain the global correlation factor of the transaction timing subgraph of this stage.

[0030] Here, the correlation between subsequent transactions and target accounts is taken into account to optimize the effective detection of illegal accounts.

[0031] Preferably, the classification output module includes a classifier, which is a two-layer fully connected layer. Based on the final representation of the target account, the classification result of the target account is obtained through the softmax function output.

[0032] The present invention also proposes a computer storage medium for computer-readable storage, on which is stored a program for detecting illegal Ethereum accounts based on a timing graph neural network. When the program for detecting illegal Ethereum accounts based on a timing graph neural network is executed by a processor, it is used to implement the steps of the method for detecting illegal Ethereum accounts based on a timing graph neural network.

[0033] The present invention also proposes an Ethereum illegal account detection system based on a time-series graph neural network, comprising:

[0034] The data collection unit is used to collect transaction data of illegal label accounts and normal label accounts to form a label data set;

[0035] A model building unit, configured to build an Ethereum illegal account detection model, wherein the Ethereum illegal account detection model includes a time-series subgraph generation module, a representation update module, and a classification output module;

[0036] A model training unit is used to train the Ethereum illegal account detection model using a labeled data set to obtain a trained Ethereum illegal account detection model;

[0037] The detection output unit is used to input the account to be detected into the trained Ethereum illegal account detection model to obtain the detection result of the account to be detected.

[0038] Compared with the prior art, the beneficial effects of the technical solution of the present invention are:

[0039] The present invention proposes an Ethereum illegal account detection method and system based on a time-series graph neural network. The transaction data of illegal labeled accounts and normal labeled accounts are combined into a labeled data set. An Ethereum illegal account detection model is constructed, which includes a time-series subgraph generation module, a representation update module, an association prediction module, and a classification output module. The Ethereum illegal account detection model is trained using the labeled data set. The account to be detected is input into the trained Ethereum illegal account detection model to obtain a detection result of the account to be detected. While learning the dynamic representation of the Ethereum account, the correlation between the target account's transaction and subsequent transactions in the account representation learning is considered, thereby further optimizing the effective identification of illegal accounts on Ethereum. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 A schematic diagram showing the flow of the method for detecting illegal Ethereum accounts based on a time sequence graph neural network proposed in Example 1 of the present invention;

[0041] Figure 2 A schematic diagram showing the structure of an Ethereum illegal account detection model in Example 1 of the present invention;

[0042] Figure 3 A schematic diagram of the structure of the Ethereum illegal account detection system based on the timing graph neural network proposed in Example 3 of the present invention is shown. DETAILED DESCRIPTION

[0043] The accompanying drawings are for illustrative purposes only and are not to be construed as limiting this patent;

[0044] In order to better illustrate this embodiment, some parts of the drawings may be omitted, enlarged, or reduced, and do not represent the actual size;

[0045] It is understandable to those skilled in the art that descriptions of certain well-known contents may be omitted in the drawings.

[0046] The technical solution of the present invention is further described below with reference to the accompanying drawings and embodiments.

[0047] The positional relationships described in the drawings are for illustrative purposes only and should not be construed as limiting this patent;

[0048] Example 1

[0049] like Figure 1 As shown, this embodiment proposes an Ethereum illegal account detection method based on a time sequence graph neural network, comprising the following steps:

[0050] S1. Collect transaction data of illegal tagged accounts and normal tagged accounts to form a tagged dataset. The transaction data includes the transaction time and transaction amount between tagged accounts.

[0051] S2. Construct an Ethereum illegal account detection model, which includes a time-series subgraph generation module, a representation update module, an association prediction module, and a classification output module; train the Ethereum illegal account detection model using a labeled dataset to obtain a trained Ethereum illegal account detection model, such as Figure 2 As shown;

[0052] The timing subgraph generation module is used to obtain the transaction timing subgraph. The training process includes:

[0053] Based on the transaction data in the labeled dataset, an m-order local transaction network is constructed. In this embodiment, a 2-order local transaction network is constructed, including: using the labeled account in the labeled dataset as the target account; sequentially using the target account as the central node, the other party's account that transacts with the central node as the first-order neighbor node, and constructing edges between the two transaction accounts, using the transaction time and amount as edge features;

[0054] First-order neighbor nodes are sequentially used as central nodes. Second-order neighbor nodes are constructed based on the central node's transaction data, and edges are constructed between the two transaction accounts. Node types are then categorized into user accounts and contract accounts. User accounts refer to accounts held by users, while contract accounts are a series of codes created by user accounts on Ethereum. These codes can only be triggered by user accounts to execute corresponding code for operations such as transfers, and their behavior is determined by the code. By segmenting user accounts and contract accounts, the impact of transaction patterns of different accounts can be more comprehensively considered, improving the accuracy of submission detection.

[0055] Repeat the above steps m times to obtain an m-order local transaction network for each tag account, where the m-order local transaction network is a heterogeneous graph. In this embodiment, m is 2.

[0056] The connected component containing the target account is extracted from the local transaction network as a transaction time-series subgraph. In this embodiment, due to the large number of node transactions on Ethereum, to reduce computational complexity, the subgraph is extracted when the k largest transactions occurred. Specifically, the transaction data of the target account is used to extract the times corresponding to the k largest transactions, and these times are sorted by chronological order. Next, for each time point t, all edges in the local transaction network with temporal characteristics before time t are retained, that is, transactions occurring before time t are retained. The connected component containing the target account is then extracted as a transaction subgraph. By using k time points, k transaction time-series subgraphs for the target account can be obtained. In this embodiment, k is 10.

[0057] The representation update module is used to calculate the timing subgraph representation corresponding to the transaction timing subgraph node. The process includes:

[0058] A graph neural network (GNN) is used to learn representations of different node types in each transaction time-series subgraph after multiple aggregations of neighboring features. The mean of the representations after all node feature aggregations is calculated as the graph representation, which is the time-series subgraph representation of the corresponding transaction time-series subgraph node. Ten graph representations are obtained by performing a model on 10 transaction time-series subgraphs.

[0059] The algorithm of the association prediction module includes:

[0060] Using a deep network model, the correlation factor between subsequent transactions and the target account is calculated through all transactions in a period of time after each time node; the representations of the corresponding nodes of the two accounts of each transaction obtained by graph neural network learning are spliced ​​together as the input of the deep network model to obtain the correlation factor of each transaction; in this embodiment, the deep network model shown is a single-layer or multi-layer fully connected network.

[0061] Calculate the average value of all correlation factors to obtain the global correlation factor of the transaction timing subgraph of this stage. Superimpose the global correlation factor and the timing subgraph representation to obtain the updated timing subgraph representation.

[0062] In this example, the 10 transaction time-series subgraphs of the tagged account are extracted when the tagged account's 10 largest transactions occurred. Therefore, when calculating the association between transactions occurring after these time points and the tagged account, transactions occurring within 50,000 timestamps after these 10 time points are considered. Specifically, in the construction of the association prediction module, an edge prediction model is constructed for training. This edge prediction model consists of two parts: a graph neural network and a fully connected network. Multiple Ethereum users are randomly selected and neighbor nodes are selected through random walks with restarts. The largest connected component is selected as the positive sampling graph. A negative sampling graph is then constructed by randomly adding virtual edges to the positive sampling graph. Both the positive and negative sampling graphs serve as the training sets for the edge prediction model. During training, the concatenation of the node and edge features learned by the graph neural network is used as input to calculate a score, using cross-entropy loss as the loss function. The second part of the trained edge prediction model is used as the association prediction module. Then, the transactions that occurred in the neighborhood within 50,000 timestamps are combined with the node representations of the two parties in each transaction and the features of the corresponding edges of this transaction as the input of the association prediction module to calculate the association factor of this transaction.

[0063] The correlation factors corresponding to transactions within 50,000 timestamps are averaged to form the global correlation factor for the transaction time series subgraph. For 10 transaction time series subgraphs, 10 global correlation factors are obtained. The global correlation factor is concatenated with the previously obtained time series subgraph representation to form a new time series subgraph representation for the corresponding tagged account. This yields 10 new time series subgraph representations for the tagged account.

[0064] The updated 10 time-series sub-graph representations are processed using a time series model to learn the time series features of the target account, obtain a series of new graph representations, and take the last graph representation as the final representation of the target account; in this embodiment, a gated recurrent unit is used as the time series model.

[0065] The classification output module includes a classifier. In this embodiment, the classifier is a two-layer fully connected layer. Based on the final representation of the target account, the classification result of the target account is obtained through the softmax function output.

[0066] S3. Input the account to be detected into the trained Ethereum illegal account detection model to obtain the detection result of the account to be detected.

[0067] Example 2

[0068] In this embodiment, a processor is proposed, which is used to run a program. When the program is running, the Ethereum illegal account detection method based on the time sequence graph neural network as described above is executed.

[0069] This embodiment also proposes a computer-readable storage medium, which stores a computer program. The computer program includes program instructions. When the computer program is executed by a processor, the processor implements the steps of the Ethereum illegal account detection method based on the timing graph neural network provided in Example 1.

[0070] The computer-readable storage medium may include any medium capable of storing program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0071] Example 3

[0072] like Figure 3 As shown, this embodiment proposes an Ethereum illegal account detection system based on a time sequence graph neural network, including:

[0073] The data collection unit 101 is used to collect transaction data of illegal tagged accounts and normal tagged accounts to form a tagged data set;

[0074] A model building unit 102 is used to build an Ethereum illegal account detection model, wherein the Ethereum illegal account detection model includes a time sequence subgraph generation module, a representation update module, and a classification output module;

[0075] The model training unit 103 is used to train the Ethereum illegal account detection model using the label data set to obtain a trained Ethereum illegal account detection model;

[0076] The detection output unit 104 is used to input the account to be detected into the trained Ethereum illegal account detection model to obtain the detection result of the account to be detected.

[0077] Obviously, the above embodiments of the present invention are merely examples for the purpose of clearly illustrating the present invention, and are not intended to limit the embodiments of the present invention. Those skilled in the art will appreciate that other variations or modifications can be made based on the above description. It is not necessary and impossible to enumerate all embodiments here. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention shall be included within the scope of protection of the claims of the present invention.

Claims

1. A method for detecting illegal Ethereum accounts based on a time-series graph neural network, characterized in that: include: S1. Collect transaction data of illegal and normal labeled accounts to form a labeled dataset; S2. Construct an Ethereum illegal account detection model, which includes a time-series subgraph generation module, a representation update module, an association prediction module, and a classification output module; train the Ethereum illegal account detection model using a labeled dataset to obtain a trained Ethereum illegal account detection model; The timing subgraph generation module is used to obtain the transaction timing subgraph; The representation update module is used to calculate the timing subgraph representation corresponding to the transaction timing subgraph node. The process includes: A graph neural network is used to learn the representations of different types of nodes in each transaction time series subgraph after multiple aggregations of neighbor features. The mean of the representations after all node feature aggregations is calculated as the graph representation. The graph representation is the time series subgraph representation of the corresponding transaction time series subgraph node. The algorithm of the association prediction module includes: Using a deep network model, calculate the correlation factor between subsequent transactions and target accounts; Calculate the global correlation factor and superimpose the global correlation factor with the temporal subgraph representation to obtain the updated temporal subgraph representation; The updated temporal subgraph representation is processed using a time series model to learn the temporal features of the target account, resulting in a series of new graph representations, with the last graph representation being taken as the final representation of the target account. A deep network model is used to calculate the correlation factor between subsequent transactions and the target account using all transactions in the period following each time node. The representations of the corresponding nodes of the two accounts of each transaction, learned by the graph neural network, are concatenated and used as input to the deep network model to obtain the correlation factor of each transaction. The average of all correlation factors is calculated to obtain the global correlation factor of the transaction temporal subgraph in the period following each time node. S3. Input the account to be detected into the trained Ethereum illegal account detection model to obtain the detection result of the account to be detected.

2. The Ethereum illegal account detection method based on the time sequence graph neural network according to claim 1 is characterized in that: The training process includes: A local transaction network will be constructed based on the transaction data in the labeled dataset; The connected component where the target account is located is extracted from the local transaction network as the transaction time sequence subgraph.

3. The Ethereum illegal account detection method based on the time sequence graph neural network according to claim 2 is characterized in that: Based on the transaction data in the labeled dataset, a local transaction network is constructed, which includes the following steps: The labeled account in the labeled dataset is used as the target account. The target account is used as the central node, and the other party's account that transacts with the central node is used as the first-order neighbor node. An edge is constructed between the two transaction accounts, and the transaction time and amount are used as edge features. The first-order neighbor nodes are used as central nodes in turn. Second-order neighbor nodes are constructed based on the transaction data of the central nodes. Edges between the two transaction accounts are constructed, and the node types are classified into user accounts and contract accounts. Repeat the above steps m times to obtain the m-order local transaction network of each tag account, where the m-order local transaction network is a heterogeneous graph.

4. The Ethereum illegal account detection method based on the time sequence graph neural network according to claim 3 is characterized in that: Extract the connected components of the tagged account from the local transaction network as the transaction time sequence subgraph. The process includes: Filter the time corresponding to the k transactions with the largest transaction amounts, sort the obtained time, and use it as the time point to be intercepted when extracting the transaction time series subgraph; In the m-order local transaction network, all edges whose time features are before each time point are retained, that is, transactions occurring before each time point are retained, and k connected components where the target account is located are extracted as the transaction time sequence subgraph.

5. The Ethereum illegal account detection method based on the time sequence graph neural network according to claim 4 is characterized in that: The classification output module includes a classifier, which is a two-layer fully connected layer. Based on the final representation of the target account, the classification result of the target account is obtained through the softmax function output.

6. A computer storage medium for computer-readable storage, characterized in that: The computer storage medium stores a program for detecting illegal Ethereum accounts based on a timing graph neural network. When the program for detecting illegal Ethereum accounts based on a timing graph neural network is executed by a processor, it is used to implement the steps of the method for detecting illegal Ethereum accounts based on a timing graph neural network according to any one of claims 1 to 5.

7. An Ethereum illegal account detection system based on a time-series graph neural network, characterized in that: include: The data collection unit is used to collect transaction data of illegal label accounts and normal label accounts to form a label data set; A model building unit, configured to build an Ethereum illegal account detection model, wherein the Ethereum illegal account detection model includes a time-series subgraph generation module, a representation update module, an association prediction module, and a classification output module; A model training unit is used to train the Ethereum illegal account detection model using a labeled data set to obtain a trained Ethereum illegal account detection model; The timing subgraph generation module is used to obtain the transaction timing subgraph; The representation update module is used to calculate the timing subgraph representation corresponding to the transaction timing subgraph node. The process includes: A graph neural network is used to learn the representations of different types of nodes in each transaction time series subgraph after multiple aggregations of neighbor features. The mean of the representations after all node feature aggregations is calculated as the graph representation. The graph representation is the time series subgraph representation of the corresponding transaction time series subgraph node. The algorithm of the association prediction module includes: Using a deep network model, calculate the correlation factor between subsequent transactions and target accounts; Calculate the global correlation factor and superimpose the global correlation factor with the temporal subgraph representation to obtain the updated temporal subgraph representation; The updated temporal subgraph representation is processed using a time series model to learn the temporal features of the target account, resulting in a series of new graph representations, with the last graph representation being taken as the final representation of the target account. A deep network model is used to calculate the correlation factor between subsequent transactions and the target account using all transactions in the period following each time node. The representations of the corresponding nodes of the two accounts of each transaction, learned by the graph neural network, are concatenated and used as input to the deep network model to obtain the correlation factor of each transaction. The average of all correlation factors is calculated to obtain the global correlation factor of the transaction temporal subgraph in the period following each time node. The detection output unit is used to input the account to be detected into the trained Ethereum illegal account detection model to obtain the detection result of the account to be detected.

Images